In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file…

Published 11 mo ago 2025-12-05 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.0

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 31%

Public exploits

none known

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 11 mo ago 2025-12-05

Exploit prediction (EPSS)

0.37% probability of exploitation in the next 30 days, higher than 31% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	5.0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N`
CNA	3.1	5.0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N`
NVD	3.1	6.5	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Affected products

CKSource CKFinder

Classification

Weakness

CWE-23 Relative Path Traversal
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

download.cksource.com /CKFinder/CKFinder%20for%20ASP.NET/2.5.0.1/
ckeditor.com /ckfinder/release-notes/ · release-notes

Sources

CVE List: CVE-2016-20023
NVD: CVE-2016-20023

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary